The blueprintue-self-hosted-edition before version 4.2.0 does not invalidate active sessions when a user changes or resets their password. The server-side session store maps userID to sessions, but the password update process only modifies the password field in the users table without destroying or marking existing sessions invalid. Consequently, an attacker with a compromised session can retain access until the session expires, which by default can be up to 24 hours or persist until browser close depending on configuration. This is classified as CWE-613 (Insufficient Session Expiration). The vulnerability has a CVSS 3.1 score of 6.5 (medium severity).

An attacker who has already compromised a session can maintain unauthorized access to the affected user's account even after the legitimate user changes or resets their password. This undermines the effectiveness of password changes as a remediation step and can lead to prolonged unauthorized access. The impact affects confidentiality and integrity but does not affect availability.

Upgrade blueprintue-self-hosted-edition to version 4.2.0 or later, where this vulnerability is fixed by properly invalidating existing sessions upon password change or reset. Patch status is not explicitly stated but the fix is included in version 4.2.0. Until upgraded, users should be aware that password changes do not revoke active sessions.